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Abstract 

This paper studies the equi-satisfiabihty of metric linear temporal logic 
(LTL) and its qualitative subset. Metric LTL formulas rely on the next 
operator to encode distances, whereas qualitative LTL formulas use only 
the until modality. The paper shows how to transform any metric LTL 
formula M into a qualitative one Q, such that Q and M are equi-satisfiable 
over words with variability bounded with respect to the largest distances 
used in M (i.e., occurrences of next), but the size of Q is independent 
of such distances. Besides the theoretical interest, these results may help 
simplify the verification of systems with time-granularity heterogeneity, 
where large distances are required to express the coarse-grain dynamics 
in terms of fine-grain time units. 



* First version June 2009; revised version April 2010. A preliminary version of this work has 
been presented at the 11th Italian Conference on Theoretical Computer Science, Cremona, 
Italy, 29 September 2009. 
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Learn well your grammar, 
And never stammer, 
Write well and neatly. 
And sing most sweetly, 

Drink tea, not coffee; 
Never eat toffy. 
Eat bread with butter. 
Once more don't stutter. 

Lewis Carrol, B.ules and regulations 

1 Introduction and motivation 

Linear temporal logic (LTL) supports a simple model of metric time through 
the next operator X . Under the assumption of a one-to-one correspondence 
between consecutive states and discrete instants of time, nested occurrences of 
X "count" instants to express time distances. LTL formulas without X — using 
only the until operator U — are instead purely qualitative: they exclusively 
constrain the ordering of events, not their absolute distance. Therefore, quali- 
tative LTL formulas express models that arc insensitive to additions or removals 
of stuttering steps: consecutive repetitions of the same state. 

The expressiveness and complexity relations between LTL and its qualitative 
subset are well known from the classic work by Lamport et al. |Lam83 , PW971 
lEteOOl IDS02[ IKS05| . The present paper studies instead the equi- satisfiability 
of quantitative (metric) and qualitative LTL formulas and determines under 
what conditions the satisfiability problem for LTL is reducible from metric to 
qualitative. The motivation behind this study refers to an informal notion of 
redundancy, which stuttering steps seem to encode. Consider a metric LTL 
formula (j) describing models characterized by many stuttering steps distributed 
over large time distances; for example, the formalization of an event for elections 
that occur every four years in November, in a variable day of the month, with 
the day as time unit. Formula (j) is large because it encodes large time distances 
in unary form with many occurrences of the X operator; for example, a four- 
year distance requires at least 1460 "next" , one for each day. However, the 
information carried by (jj is prominently redundant as every stuttering step is 
a duplication that only pads uneventful time instants. Is it possible, under a 
rigorous assumption of "sparse events" , to simplify (f) into an equi-satisfiable 
formula ((>' which does not encode explicitly the redundant information? 

The first result of the paper shows that LTL and its qualitative subset are 
equi-satisfiable, hence every generic LTL formula (j) admits a qualitative formula 
(j)' that is satisfiable iff (jj is. Given the aforementioned expressiveness gap be- 
tween quantitative and qualitative LTL, (/>' has to introduce new propositional 
letters. This result is a consequence of Etessami's [EteOO] and is not practically 
useful to reduce the complexity of formulas encoding large distances: the sizes 
of 4>' and (j) are polynomially correlated, so (j)' essentially encodes, in a different 
form, the same information as (j). 

This first construction is, however, the basis of a sharpening that introduces 
the notion of bounded variability. Models with bounded variability have, over 
every interval of fixed length, only a limited number v of steps that are not 
stuttering (i.e., redundant repetitions). The second construction of the paper 
shows how to transform any LTL formula cf) into a qualitative formula cf)' that 
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is equi-satisfiable to over models with bounded variability. The size of 4>' 
does not depend on the distances (i.e., the number of occurrences of X) in </) 
but only on the maximum number of non-stuttering steps v. Intuitively, 0' 
drops some information encoded in (j); this information is not needed to decide 
satisfiability over models with bounded variability. On the technical level, this 
second construction introduces a normal form for quantitative LTL formulas and 
discrete-time generalized versions of the dense-time Pnueli operators |HR04j . 

Besides the theoretical interest, the results of the present paper may be 
practically useful to simplify the temporal-logic analysis of systems characterized 
by heterogeneous components evolving over wildly different time scales, such as 
minutes, weeks, and years. Assuming incommensurable distances are not a 
concern, such heterogeneity of time granularities [FM MRIO] can, in principle, 
be modeled in terms of the finest-grain time units; but this solution comes 
with a significant price to pay to accommodate the largest time units in terms 
of the smallest, resulting in huge formulas. If, however, the dynamics of the 
components with faster time scales are "sparse" enough, there is a redundancy 
in the global behavior of the system that the notion of bounded variability 
captures. Hence, the analysis can be carried out more efficiently by leveraging 
the results of the present paper. 

Related work. To our knowledge, this is the first work comparing LTL and 
its qualitative subset with respect to satisfiability (as opposed to expressiveness 
and complexity) , and introducing and studying the notion of bounded variability 
and Pnueli operators over discrete time (as opposed to dense time). 

The comparison between quantitative and qualitative LTL with respect to 
complexity and expressiveness is well understood within the framework of "clas- 
sic" temporal logic (e.g., (GHR94nEme9 0. DS02 ). Lamport introduced the no- 
tion of stuttering to characterize qualitative LTL [Lam83| : the characterization 
was completed by Peled and Wilke |PW97j and generalized in |KS05) . The proof 
of the equi-satisfiability of qualitative and quantitative LTL — given in Section[5] 
— is linked to a result of Etessami's [EteOO] . 

Different notions of bounded variability for behaviors over dense (or con- 
tinuous) time have been studied by several authors [Wil94, Fra96, FR08 . The 
proofs of the main results of the present paper use a technique that removes and 
adds stuttering steps in words to match some metric requirements; the notion of 
stretching — introduced in HR05 and further used in [BMOWOSj — exploits 
a related technique but over dense time models. 

Hirshfeld and Rabinovich studied the expressiveness and decidability of Pnueli 
operators over dense time [HR04] ; the operators themselves were first mentioned 
in a conjecture attributed to Pnueli |AH921 rWil94] . 

The problem of formalizing systems with heterogeneous time granularities 
using temporal logic has been studied by a few authors ICCM+ 91. BHIOJ. See 
also the survey [FMMRIO] for a discussion on the problem of time granularity 
heterogeneity. 

Outline. The rest of the paper is organized as follows. Section [2] introduces 
basic definitions, including LTL and bounded variability. Section[3]outlines a few 
examples that illustrate the results of the paper. Section 2] presents extensions 
of LTL with the Pnueli operators. Section [S] contains the first main result of the 
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paper: the equi-satisfiability of LTL and qualitative LTL. Section [S] presents the 
second major result of the paper and details how the metric information can 
be relaxed while preserving satisfiability, for models with bounded variability. 
Finally, Section [7] outlines ideas for future work. 

2 Definitions 

This section introduces the syntax and semantics of LTL. IN denotes the set of 
natural numbers {0, 1,2, . . .}. 

LTL syntax. The following grammar defines the set of LTL formulas: 

LTL 3 ::= x I ^(/) I 01 A02 I 01 U02 I X0 

where x ranges over a set V — {p, q,r, . . .} of propositional letters. 

Assume the standard abbreviations for T,_L,V,^,<^ and for the derived 
temporal operators eventually: fcj) = T U 0; always: G(j> == -iF-i0; release: 
01 R02 = ^(-'01 U -.02); and distance X''0 XX - for fc > 0. 

k 

Size and height. Let be an LTL formula. |0| denotes the size of 0, encoded 
as a string. P{<j>) C V denotes the (finite) set of propositional letters occurring 
in 0. For a temporal operator H G {U,X}, the temporal height (or nesting 
depth) 'H{4>, H) of H in is the maximum number of nested occurrences of H in 
0. For example, ?^(0,X) = iff X is not used in 0. l(U''i,X''2) denotes the 
fragment of LTL whose formulas ip are such that 'H{ip, U) < hi and 'H{tp, X) < /12. 
Omit the superscript to mean that there is no bound on the temporal height 
of an operator. Hence, L(U,X) is the same as all LTL; l(U,X°) = L(U) denotes 
qualitative LTL, where no next operator is used; and l(U",X°) — P{V) denotes 
purely propositional formulas where no temporal operators are used. 

w-words. An uj-word (or simply word) over S* is a mapping w : IN — !■ 2"^ 
or, equivalently, a denumerable word w{0)w(l) • • • of elements w{i) C S. For 
T C S, w\t is the projection of w over T, defined as w{0)\tw{1)\t • • • , where 
w{i)\T — w{i) \ {S\T) for all i e M. The projection is extended to sets of words 
as expected. For i,j £ M, Wi denotes the suffix w{i)w{i + 1) • • • of w; w{i,j) 
denotes the subword of w of length j starting at w{i) (with w{i, 0) = e for all 
i); and w{i : j) denotes the subword w{i)w{i + 1) • • • w{j) (with w{i,j) = e for 
ah j < i). 

LTL semantics. The satisfaction relation |= is defined as usual, for an LTL 
formula 0, interpreted over an oj-word w over V, at position i £ IN^. 



w. 


A\=P 


iff 


p G w{i) 


w. 


i 1= -.0 


iff 


w,i ^ (/) 


w. 


? 1= 01 A 02 


iff 


w,i 1= 01 and w,i |= 02 


w, 


Z 1= 01 U 02 


iff 


there exists j > i such that w, j ^ 02 








and for &\\ i < k < j it is w. A: |= 0i 


w. 




iff 


w, i + 1 1= 


w 




iff 
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strict until. Note that a non-strict until is assumed, as a strict until would 
make the next operator redundant. Indeed, let w,i \= p U"*" q be defined as there 
exists j > i such that w,j \= <f>2 and for aW. i <k < j it is w, fc \= 4>i- Then, Xp 
is equivalent to {p ^ p U+ p) A {^p U+ p A p R+ p). 

Satisfiability and validity. |(/)] denotes the set {w E (2'')" \ w \= (j>} oi 
all models of 0. </) is satisfiable iff |?!)] 7^ and is valtd iff |0] = (2'^)". Two 
formulas (t>i,(t>2 are equivalent iff = |</'2]; they are equi- satisfiable iff they 
are either both satisfiable or both unsatisfiable. 

Stuttering. A position i € IN is redundant in an w-word w iff w{i + 1) = w{i) 
and there exists a j > i such that w{j) ^ w{i); a redundant position is also 
called stuttering step. Conversely, a non- stuttering step is any position i such 
that w{i + 1) 7^ w{i) or + j) = w{i) for all j G IN. Two words wi,W2 are 
stutter- equivalent (or equivalent under stuttering) iff one can be obtained from 
the other by removing an arbitrary number of stuttering steps. A set of words 
W is closed under stuttering (or stutter-invariant) iff for every word w e W, 
for all words w' such that w and w' are stutter-equivalent, w' E W too. A 
stutter-free word is one without stuttering steps. 

Proposition 1. Closure under stutter equivalence is a necessary and sufficient 
condition for qualitative LTL languages; that is: 

• \Lam83}/ (p G L(U) implies that |0] is closed under stutter equivalence; 

• \F W97l W closed under stutter equivalence and expressible in LTL implies 
there exists (j) e L(U) such that \<f)\ — W . 

Variability. Let be a set of words and w, k two positive integers. A set of 
propositional letters P QV has variability bounded by v/k in W iff: for every 
w G W , the projection w{i, k)\p over P of every subword w{i, k) of length k has 
at most V non-stuttering steps. var{P,v/k) denotes the set of all words where 
P has variability bounded by v/k. Note that var(P, t;/fc) is not closed under 
stuttering for any v < k. 

3 Examples 

This section presents two example LTL formalizations of systems with time gran- 
ularity heterogeneity, where events occur sparsely over large time scales. 

3.1 The school exam 

The first example, in Table[l] formalizes a simple description of an exam session. 
Assume a one-to-one correspondence between hours and positions in a word; 
that is, the hour is the time unit. Propositions d and m hold at the beginning 
of every day ((T|) and month ([2]), respectively. Any exam finishes (estop) in exactly 
three hours, and always by the end of a day ([3]). There is at most one exam 
every day (I3HS1). Every student must turn in (t) her exam before the exam 
finishes Q. Once the exam is turned in, it is sent (n) to the TAs by the end of 
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d X(^dUd) A X^^d (1) 

m ^ Xi^mUm) A X^-^-^^m (2) 

Sstart ^ -iCstop A-idAX((-.estop A^d) UCstop) AX^Gstop (3) 

Cstart ^ restart U d (4) 

Cstop ^ -'(estop V estart) U d (5) 

Cstart => tR ^Cstop (6) 

t ^ nR^d (7) 

n grR-lTO (8) 



Table 1: The school exam example. 



the day for grading ([7]). After being received by the TAs, it will be graded {g) 
by the end of the current month ([5]). 

The complete system specification is given by: 



GIdllAQAdSllAdlAdSDAdniAdTiA®) 



(9) 



The following formula is the separated- next form of where the first 
conjunct corresponds to k G L(U). 

/ {vi 4^ ^d\Jd) A {v2 <^ -im Urn) \ 
A {v3 <t4> (-lestop A ^d) U Cstop) 

A (estart => restart U d) 
A (Cstop =^ -'(estop V Cstart) U d) 
A (estart ^ tR ^Cstop) 

A (t ^ n R -^d) A (n => c/ R -im) 
A {d ^ xi A X5) A {m ^ X2 A xq) 
V A (estart ^estop A ^d A ^3 A 2:4) / 

Notice that: \ViCUI)\ = 16, = Mj^J = 6, |((ini)|x = 24 • 30 = 720 

the latter dominates over the other size parameters, including | p^ |ii ~ 100. 



AG 



/ {xi <^Xvi) 

A{X2 <^XV2) 

A {x3 ^Xua) 
A (2:4 ^^X^Cstop) 
A{x5-^X^^d) 
\ A(a;6 ^X24-3nr 



/ 



(10) 



3.2 The elections 

Consider elections that occur every four years, in one of two consecutive days. 
The example is deliberately kept simple to be able to demonstrate it with the 
various constructions of the paper. Proposition q marks the first day of every 
quadrennial, hence it holds initially and then precisely every di = 365 ■ 4 = 1460 
days. The elections e occur once within every quadrennial; precisely they occur 
d2 — 40 or c?3 = 41 days before the end of the quadrennial. The behavior is 
completely described by the following formula. 

qAG{q^X{^qA^qUq)AX'^''q)AGfe , . 

G{e^^q A X (^eUg)) A G (e ^ X '^^g V X '^^g) ^ ^ 

It should be clear that the variability of every model of (|TT]) is bounded: over 
every quadrennial (1460 days), at most one event p and one event e can happen 
— which corresponds to a variability of 4/1460 (each event is counted twice to 
account for its becoming true and then false again). 
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4 Extensions and normal forms for LTL 



This section introduces some extensions of LTL that do not affect its expres- 
siveness or its complexity; all constants are encoded in unary. It also shows 
how to transform any LTL formula in a normal form where nesting of temporal 
operators is limited; the results in the following sections will use this normal 
form. 

4.1 Extending LTL with counting 

LTL*- extends LTL with the counting modalities Cj! for fc,n G IN^. it;, i ^ 
holds iff there exist (at least) k positions over the interval [i + + n] where 4> 
holds. Counting modalities do not affect the expressiveness of LTL over discrete 
tim^il as they can be encoded as follows: 

^ V A XV (12) 

SC[l..n] tes 
|S|=fe 

The size of ((T^) is (^) , worst-case exponential in 

The complexity of the satisfiability problem for LTL'- is, however, the same 
as for LTL. To see this, it is sufficient to show an encoding of the counting 
modality C^? into an equi-satisfiable LTL formula which avoids the exponential 
blow-up. To this end, add fresh propositional letters for 1 < i, j < n. 
Intuitively p'j holds iff C* does; formally, a formula of size 0(n • |0|) defines 
as: 

{(p}l\ A X V) V l<j<i<n 
X F<i_i0 I = j < i < n 

X0 l^j^i 
± j>i 

To check the satisfiability of an LTL*- formula ip with counting modalities, change 
ip into V' by replacing every occurrence of CJ! cj) with p^' and then check the sat- 
isfiability of the new formula ■0' = A/\j ^- G(p^- • • • ) including the definitions 
of the pj. The size of iJj' is polynomial in the size of ip, and V^' is satisfiable iff 0^ 
is; this proves that LTL and LTL*- have the same PSPACE worst-case complexity. 

Pnueli modalities. LTL^" extends LTL with the Pnueli modalities Pn)! for 
k,n E fi. w,i ^ Pn^!(0i, . . . , 0fc) holds iff there exist k positions i + 1 < 
ki < k2 < ■ ■ ■ < kk < i + n such that w, kj \= for all 1 < j < k. LTL^" 
subsumes LTL'-, because CjJ = Pn^(0, . . . , 0); LTL^" also has the same expres- 
siveness and complexity as LTL. The proof follows an argument similar to the 
case of the counting modalities; in particular, to encode the satisfiability for 
LTL^"in LTL, introduce n'^ propositions pj for 1 < i, j < n, such that pj holds 
iff Pn}(0i,...,0j) does. 

^Unlike over dense time |HR04| . 

2 Recall that ^ < (^) | GKP94| . hence in particular (^"j) ^ 2"/^. 
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4.2 Flat-next form 

An LTL formula is in flat-next form (FNF) when it is written as: 

K A /\ G{xi <=^XTTi) (13) 
i=l,...,N 

where k G L(U), £ T', tt; G P('P)- The nesting depth of the X operator is one 
in (dSl); that is ((13) £ l(U,X1). 

Lemma 2. For any (p G LTL it is possible to build, in polynomial time, an 
equi- satis fiable formula rj in FNF. 

Proof. Initiahy, let Q = V and 4>' = (/). Repeat the fohowing two steps, working 
recursively starting from the top-level of </>', until (p' G L(U): 

1. Replace a qualitative sub-formula ip G L(U) of (/)' that is within the scope 
of some X operator by a fresh prepositional letter p^, and add p^ to Q. 

2. Replace a sub-formula of (p' in the form Xvr, with tt G P(Q), by a fresh 
prepositional letter pxtt, and add px^r to Q. 

Steps 1-2 are repeated at most a number of times proportional to the size \4>\ of 
(f>. Define K as (j)' f\ /\p^(^Q Q{p^<^%p). Finally, 77 is k A Ap^^es *^(PX7r Xtt). 

rj is in FNF and it is equi-satisfiable to (p. □ 

Example 3. The following is formula ([TT|) of the elections example in flat- next 
form; the first conjunct is the qualitative part k, and Xk encodes X^^g for fc > 1. 



gAG 



/ (m ^ -le U q) A (u <^ -iq A -iq U q) \ 

h{q^ x^ hXdi) /\ Fe 
A (e ^ -.g A Xu) 
\ A (e ^ V 2:^3) / 



{xu 4^ Xu) A [xy <^Xv) 
AG I A(.Ti ^ Xg) 



(14) 



4.3 Separated-next form 

An LTL formula is in separated-next form (SNF) when it is written as: 

K A /\ G(a;,^X»«^,) (15) 

i=l,...,M 

where k G L(U), Xi G V, tt^ G P('P), and D is a monotonically non-decreasing 
mapping [1..M] — IN>o. 

Given that the FNF is a special case of the SNF, it is obvious that any 
LTL formula can transformed into an equi-satisfiable SNF one in polynomial 
time. However, the SNF becomes interesting when it isolates subformulas with 
a nesting depth of X as high as possible, as the rest of the paper demonstrates. 

Given a formula (p in SNF (fT5|) . \(p\u ~ |0|g — M, \(p\p = max^Tr^, and 
\(p\x = maxiD(i) — D{M) denote respectively the until, globally, propositional, 
and next size of the components of (p. Then, |0| is in 0(|(/)|u -t- |0|g(|</>|p + |0|x))- 
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Example 4. The following formula f2 is formula (ITT]) in separated-next form, 
with di =d2 = 1, ds = 40, = 41, = 1460. 



qAG 



V 



A (u -ig A -iq U q) 
A (g ^ X2 A xs) A Fe 
A (e ^ -iq A xi) 

\ A (e ^ V y y 



AG 



A (x2 ^ X''^^) 
A (X3 ^ X'^^q) 

A (X4 ^X'^^q) 

V A(X5^X*(7) / 



Notice that 6 L(U) is the first conjunct, |7'(rJ)| = 9, = Mn 

^^|x — d^'i the latter dominates over the other size parameters. 
The following is a (partial) model of il. 



(16) 



5, 



1 


2 


3 


4 


• 1420 


1421 


1422 


1423 • • 


• 1460 


1461 


q 






^9 • • 


-.9 




^9 


-nq ■ ■ 


-nq 


9 




-le 




-le 




e 


-le 




-le 




u 










-iM 




u 


u 


u 


-IV 


V 


V 




?; 


V 


V 


V 


V 


-IV 




-^xi 


-.Xl 


^xi ■ • 




Xl 


Xl 


Xl 


Xl 


-.Xl 


X2 


X2 


a;2 


X2 


2:2 


X2 


X2 


X2 


-.X2 






^X3 




^X3 ■ ■ 


• -'Xs 


X3 


^X3 


-.X3 ■ • 




-'a;3 


-1X4 


-1X4 


-1x4 


-1X4 


a;4 


-1X4 


-1X4 


-1x4 


-1x4 


-1x4 


X5 


-^X5 


-nX5 


-■X5 • • 


-1x5 


-•X5 


-■X5 


-•X5 • • 


-■X5 


X5 



In any such model there are at most 6 non-stuttering steps over [1..1460]: po- 
sitions 1,1419,1420,1421,1459,1460; hence the variability is 6/1460 and let 
= 6 and Dn = 1460. 



5 LTL and qualitative LTL are equi-satisfiable 

This section shows how to transform any LTL formula into an equi-satisfiable 
L(U) formula. The construction is the foundation for the novel results of Sec- 
tion [51 



Informal presentation 

The construction to turn an LTL formula into an equi-satisfiable qualitative one 
works as follows. Introduce a fresh propositional letter s. Constrain s to change 
truth value with any propositional letter in V] in other words, any non-stuttering 
step coincides with a non-stuttering step of s. Then, replace any occurrence of 
a subformula Xp with a suitable until formula that defines the value of p at 
the nest non-stuttering step of s. This changes the quantitative Xp formula 
into a qualitative formula where the precise metric information is relaxed. Very 
informally, this basic idea can be regarded as a discrete-time analogue of the 
stretching introduced in [HR05) and further exploited in |BMOW08] . 



Formal presentation 

For an LTL formula in FNF ry G l(U,X1) over V — V{ri), we build another 
formula ^ G L(U) that is equi-satisfiable to 77. To this end, let s ^ P be a fresh 
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prepositional letter. For every propositional formula tt G P('P), define: 



■AF- 



V 



/ s U (-.TT A -.s) \ 

V 

-iS U (-iTT A s) 
V 

VgeP\{7r}(9A7r) U(^9A7r) 
V 

V VgGP\{^}(-9A7r) U(gA7r) / 



Y(P) ^ /\ GpVG-p 

X^tt) = sUttV-sUtt 
A'2(7r) = (ttAs =J> -.sRtt) A (tt A -.s =^ sRn) 
X{Tr) 4 A'^(7r) AAf2(7r) 

A(7r) links any transition of the truth value of tt to occur simultaneously with a 
transition of s. XItt) is instead essentially a qualitative relaxations of the next 
operator: w,i \= X{p) holds iff the next non-stuttering step of s is j > i and 
w,j + l \= p holds. 

Finally, build a qualitative formula ^ from r] as: 



r{'P)/\ /\G{x{p)AX{-^p)) A K A /\ G 

peP i=l,...,N 



Xi ^ X{Tri) 
A 



Lemma 5. r] and ^ are equi- satis fiable formulas. 

Proof. Remind that V{r]) = V and ■p(^) = P U {s}. The proof is in two parts. 



SAT(r7) ^ SAT(^). In the first part we show that ^ is satisfiable if is 
satisfiable. Hence, assume w \= rj iov some w G (2'P(.'n)'j'^ _ Let us build x G 
(2^(«))'^ such that x \= ^. 

Indeed, x coincides with w over V{r]), hence x \= k because s ^ V{k). In 
addition, s is added to x according to the following recursive definition: s G x(0) 
and, for « > 0, if w{i — 1) = w{i) then s £ x{i) s € x{i — 1), whereas if 
w{i — 1) w{i) then s G x{i) O s ^ x{i — 1). In other words, s switches 
its truth value at non-stuttering steps — except possibly for an infinite tail of 
constant states. 

For any p £ 7^(77) let us show that x ^ r{V) A G {x{p) A X{^p)). The proof 
of x 1= y{V) is routine. Then, let « G IN be such that x,i \^ p. If x,i \= Gp 
then trivially x,i |= X{p), because the tt A F->7r is false at i. Otherwise, let j > i 
be the least integer such that x,j \= ^p. If no other proposition changes truth 
value over x{i : j), that is if x{i : j — i)\-p{rj) is a sequence of stuttering steps, 
then s switches its truth value precisely at j. Hence, one of x,i \= sU {^p A -is) 
and x,i \= (J {^p A s) holds. Otherwise, there exist q ^ p and k < j such 
that cither x,i \= q and x, k \= ^q ov x,i \= —^q and x,k \^ q. In the former 
case {q Ap)\} {-^q A p) holds at «, whereas in the latter case (-ig Ap) (i{q Ap) 
holds at i. Hence, if a;, z \= p then x,i \= X{p) A A(-'p) is established. If 
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x,i \= instead, a similar reasoning also proves that x,i\= X{p) A A(-ip). In 
all, X \= G{x{p) A A(-ip)) holds. 

Finally, let us prove the last conjunct of ^, for a generic h G [l..A^]. Let 
i G IN such that x,i \= Xh- we prove that x,i \= X{7rh)- Since we are assuming 
T], x,i + l \= TTh holds. 

If x,i \= s then clearly x,i \= s 1)77^. In addition, assume that x,i \= TTh- we 

have to show that -is R tt/j. That is, for a generic j > i, either x, j \= TTh or there 
exists i < k < j such that x,k \= -is. The goal is trivial for j = i, as x,i \= tt/j 
by assumption. It is also trivial for j = i + 1, as x, i + 1 |= nh also holds. For 
J > i + 1, assume advcrsarially that x, j |= -itt^. Notice that this implies that 
x,j — 1 \= -'Xh, hence Xh changes its truth value from true to false at some 
i < m < j — 1. Then, x{m) ^ x{m + 1) is not a stuttering step, which implies 
that s also changes its truth value at m. Since s is true at i, s must be false at 
some i<k<m + l<j — l<j. So x,k \= which closes the current branch 
of the proof. 

Let us now consider the case x,i \= -^s hence x,i |= -is Utt^. Similarly as we 
did in the previous case, we can establish also that if x,i \= Wh then sRnh- In 
all, we have shown that x,i \= X{Trh)- 

For i G IN such that x,i \= -'Xh, a very similar reasoning shows that x,i \= 
(""'■/»)• In all, X \= Q{xh => X{'Kh)) and x \= Q{-^Xh => X{-^TTh)) is established. 

SAT(^) SAT(?7). Let us now show that rj is satisfiable if ^ is satisfiable. 
Hence, assume that w ^ ^ for some w e (2^('')u{s})'«^. Let us build x € (2^(''))'^ 
such that X \= rj. 

Build y from w by removing all its stuttering steps. Then, let z G IN be a 
generic position and h G since y \= ^ then in particular y,i \= Xh => 

X{Trh) and y,i\= ^Xh ^ X{^7Th). Let us show that y,i \= Xh -^Xwh- 

1. Assume y,i \= Xh /\ X{Trh)- Advcrsarially, let y,i + 1 \= —'Wh- We now 
discuss two cases, whether y,i \= TTh or y,i \= ^iTh, and we show that in 
both cases we reach a contradiction, hence y,i + l \= tth- 

(a) Assume y,i \= TTh- Also, assume that y,i \= s; this is without loss 
of generality because X{TTh) is symmetric with respect to the truth 
value of s. Since tt/i switches from true to false at i, some proposition 
r ^ s changes its truth value at i. Hence, X{r) A A(-ir) forces s to 
also change its truth value at i. In all we have the following situation: 

Xh 

TTh "'TT/i 
S -iS 

i i + 1 

But then X'^{TTh) requires in particular -is Rtt/j to hold at i; this is 
however false because neither y,i-\-l \= TTh nor y,i\= ^s. Hence, the 
contradiction. 

(b) Assume y,i \= -itt/,. Also, assume that y,i \= s; this is without loss 
of generality because X{TTh) is symmetric with respect to the truth 
value of s. Note that X-^{TTh) implies that TTh must eventually hold; 
let j > i + 1 be the least instant such that y,j\=TTh- So, tt/j does 
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not hold at all positions in — 1] and becomes true at j. From the 
assumption that y has no stuttering steps it must be y{i + 1) 7^ 
Hence there exists some atomic proposition r that changes its truth 
value at i. Correspondingly, X{r) A A(-ir) forces s to also change its 
truth value at i. In all we have the following situation: 



Xh 








r 




s 


-IS 


i 


i + l 



But then X^{'Kh) cannot hold at i, because neither sViiTh nor -is U tt/j 
holds at i. Hence, the contradiction. 

2. The proof of the other case y,i \= ^Xh A X{-^Tih) can be obtained by 
symmetry from the previous case. 

Since i and h are generic, we have established y \= Ai=i n *^(^* ^ Xtt.;). 
In addition w \= k implies y \= k as well, because y is obtained from w only 
by removing stuttering steps and k G L(U) is closed under stuttering. Hence 
X = y\-p(ri) is a model that satisfies ry. □ 

Example 6. Let f ([M]) be formula (jl4|) modified according to the construction 
of the present section. The proof of Lemma [5] shows that the qualitative formula 
^(HH) preserves the stutter- free models of the equi-satisfiable LTL formula (ITi)) . 
On the other hand, consider a model of with a sequence of c?5 — 2 stuttering 
steps -iq ■ ■ ■ -iq q, such as the one in Example [31 it corresponds to the following 

d5-2 

stutter- free model of f (fT4)) : 



^9 




-nq 


-■9 


-■xi 




■ ■ -ixi 


-^Xi 


-^X2 


-^X2 


• • -^X2 


X2 


-^X3 


-^X3 


X3 





-■Xds-S Xd^-3 

This shows that the transformation of into ^ (|14p — and more generally of 
T] into ^ — does not represent the redundancy of words with bounded variability 
more succinctly, but merely encodes it in a different form. 



6 Relaxing distance formulas 

This section sharpens the results of Section [5] by showing how to encode the 
redundancy of stuttering steps more succinctly in words with bounded variabil- 
ity. The following results require LTL'^''" and LTL^'*''^", two extensions of L(U) 
with qualitative counterparts of the Pnueli operator discussed in Section 14.11 
Section 16.11 introduces these extensions and shows that they have the same 
complexity as LTL. Then, Section [6.21 shows how to transform any LTL formula 
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(j> (given in SNF) and a positive integer parameter V into a LTL^'*'''^" formula 
(j)' which is equi-satisfiable to </> over words with variabihty bounded by V/I?, 
where D is the largest distance used in </>. The size of </)' is polynomial in V, 
the number of distance sub-formulas, and the size of propositional sub-formulas 
appearing ip; however, the size of </>' does not depend on the values of distances 
in (p. As a consequence, checking the satisfiability of 4>' is much less complex 
than checking the original whenever the distances used in are very large 
and dominate over the other size parameters. 



6.1 Qualitative Pnueli operators 

^j^qPn extends LTL with the qualitative Pnueli modalities qPn^ for fc, n g IN. 
w,i ^ qPn5!(0i, . . . , (j)k) holds iff there exist k positions i < ki < ■ ■ ■ < kk such 
that, for all 1 < j < fc: (1) kj is a non-stuttering step; (2) w,kj +1 ^ 
and (3) there are no more than n non-stuttering steps between i and kk (both 
included) . 

Example 7. Consider the following word w; non-stuttering steps are in bold 
and underlined. 



1 


2 


3 


4 


5 


6 


1 


8 


9 


10 


11 


12 


13 


14 


s 








-IS 


-IS 


s 




-IS 


-IS 


8 


s 




s 


-IV 


V 


V 


V 


V 


V 


V 


V 


V 


V 


V 


V 


V 




q 


-^q 


-"7 


^q 


^q 


-"7 


-^q 


^q 


^q 


^q 


-"7 


-^q 


^q 


q 








-le 


-le 


-le 




e 


e 


e 








-le 



Then, w,l \= qPn^{v, ^q,e,q) holds for the positions 1,6,7,13; but w,8 ^ 
qPnl{s,q) because w, 13 ^ q. 

Any LTL''^" formulas admits an equi-satisfiable LTL formula, and their sizes 
are polynomially correlated; hence LTL''''" and LTL have the same worst-case 
complexity. The proof introduces a fresh letter s, which is constrained to change 
truth value with the other letters in V (as detailed in Section [5]) • It then uses 
an encoding similar to that of "standard" Pnueli operators (see Section 14. ip , 
where the qualitative X operator — introduced in Section [5] — replaces the 
quantitative X; namely, to encode a formula qPn|^((/)i, . . . , 0„) introduce 
propositional letters {qf \ 1 < i,j < n}. Every qj holds iff qPn^ ((/)i, . . . , 0^) 
does; formally, a formula of size 0{n ■ defines as: 



' (^qi_l A X3 (0O) V l<t<J<n 

^{(piW X{(t>iV ■ ■ ■)) l = i<j<n 

j nested X 

± i>j 



(17) 



where abbreviates XX ■ ■ ■ X . In the following, T{q,i,j,n,(f>i,...) denotes 

j 

(|T7t with q,i, j ,n, (pi, . . . respectively replacing q, i, j, n, 0i, .. .. 
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The construction outlined is general, but the remainder of the paper only 
considers LTL''^" formulas in the form: 

E ^ r{r)A/\G{x{p)Ax{^p))A^ A A G((6^qPn;;;;(v'i,...,vjw)) 

pev i=l M 

(18) 

for a set of propositions Q — VU{s}, where J, I are two mappings [l..Af] — > JN>o, 
K,ipi S L(U) for all 1 < i < M, e P('P), and s does not occur in k or in any 
ipj. Correspondingly, introduce fresh letters (j'(j)^ and construct S' from S: 

'Y(^)AApepG(A(p)AA(-p))' 
A K A 

A.=i,...,MGte^'7wj:;) 

A /\ Gr(g(fc),*,j,J(fc),V^,...,^i%)) (19) 

l<k<M 
l<ij<J(fc) 

Lemma 8. The following hold for S, S'; 
i. S' G L(U); 

^. is polynomially bounded by \E\ (and can be built in polynomial time); 

3. |S| is closed under stuttering; 

4- S' and S are equi- satis fiable; 

5. |S| equals the projection over Q of . 

Proof sketch. [T] is clear by construction. 

m The size |S| of S is polynomial in |Q|, /, J, A/, where J, / denote max^ J(i) 
and maxil(i), respectively. The first subformula of S': 

Y (P) A /\ G(A(p) A A(-p)) A « A /\ G(C, ^ 9(i)J;}) (20) 

p£V i=l,...,M 

has size bounded by \E\+M-I-J, hence also 0(|S|). The second subformula 
of S': 

/\ GT(g(fc),j,j,J(fc),V^...,Aw) (21) 

l<fe<Af 
l<ij<J(fc) 

has size bounded by M ■ ■ 0(J), hence also polynomial in |E!|. 
[3] follows from [T] and [5] 
ID follows froni[5j 

[5] follows from the definition in ([TT]) and the semantics of the X operator, 
along the lines of Lemma [5j □ 
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Qualitative extended Pnueli operators 



jl^YLexqPn |-j^g ^^^^ extension of LTL we consider. LTL^^'''^" introduces tlie quali- 
tative extended Pnueli modalities exqPn^'^"^' "'"''^ for fc, n e W and ni, . . . , nfc £ 

IN U {*}. w,i \= exqPnJ!'^"^' "'"''^ (01, . . . , holds iff there exist k positions 
i < ki < ■ ■ ■ < kk such that, for aU I < j < k: (1) kj is a non-stuttering step; 
(2) w,kj + I \= (3) for j > 1, if rtj ^ * then there are no more than Uj 
non-stuttering steps between fcj-i and kj — 1 (both included); (4) if ni 7^ * 
then there are no more than ni non-stuttering steps between i and ki (both 
included); and (5) there are no more than n non-stuttering steps between i and 
kk (both included). Intuitively, the qualitative extended Pnueli modalities gen- 
eralize the qualitative Pnueli modalities by imposing an additional requirement 
on the relative distance of k non-stuttering steps; for example, if ni = 1, 0i 
must hold right after the first non-stuttering step that follows or is at i, inde- 
pendently of the other following k — 1 non-stuttering steps. If (ni, . . . ,nk) is 
then the qualitative extended Pnueli modality reduces to the corresponding 
qualitative Pnueli modality. 

Example 9. Consider again word w from Example!?] For the positions 1,6,7, 13, 
w,l \= exqPn4'^^'^'*'^^ {v, ->q, e, q) holds. However, w, 1 ^ exqPn4 ^■^'^'*'^^ [v, ^q, e, 
q); in fact, let fci, . . . , ^4 be the positions that match the semantics of the op- 
erator. Then, ki = 13 as g only holds at 14, so that the last component of 
the constraint (3, 2, *, 1) forces ^3 to be 12, the non-stuttering step immediately 
before 13; but u;, 12 + 1 ^ e. 

Any LTL^'*'^^" formula has an equi-satisfiable LTL formula of polynomially 
correlated size. Again, the proof follows the same lines as for LTL''''": to encode 
a formula exqPn^'^"^' ' '"'°^(0i, . . . , 4>k) introduce letters Q = {qf \ I < i,j < 
n}. Every qf holds iff exqPnf^^^ " (pi) does; formally, a formula of 

size 0(n • |0i|) defines pi as: 



' 



1 < i < J < n 

AO <n.i < j 



Ui nested X 




l<i<j<nA 
{ni = *\J ni> j) 
1 = i < j < n 



A'(0iv;f(0i V---)) 



min(j,ni) nested X 



AO <ni ^ * 
l = i<j<nAni 



j nested X 




l = i^jAnij^O 
i > j W Hi — 



(22) 



The reminder of the paper deals with LTL^^'' formulas in the form: 




^ exqPn: 



(23) 
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for a set of propositions Q = PU{s}, where J, I are two mappings ]N>o, 
K is a mapping [1..M] {KU{*}Y^'\ k, ^P, G L(U) for all 1 < ? < M, £ P(V), 
and s does not occur in k or in any ipf . It is not difficult to adapt Lemma [5] to 
the LTL^'*''^" formula A and prove the following. 

Lemma 10. Given A, it is possible to build an LTL formula A' such that: 

1. A' g L(U); 

2. I A' I is polynomially bounded by |A| (and can be built in polynomial time); 

3. |A] is closed under stuttering; 
4- A' and A are equi-satisfiable; 

5. |A] equals the projection over Q of |A'] . 

6.2 Relaxing distance formulas 

This section contains the main result of the paper, summarized in the following. 

Theorem 11. Given an LTL formula (p in SNF over propositions in Q, and an 
integer parameter Y > 0, it is possible to build, in polynomial time, another LTL 
formula 0" such that: 

• \4>"\ is polynomial in |Q|, V, |0|u: I'/'lc |0|p but is independent of \(j)\x; 

• (j) and (j)" are equi-satisfiable over words in var(Q, V/|0|x)- 

The following construction shows how to build a. (f>' € LTL^*'''^" from </> such 
that Lemmas fT3l and [T4l hold. Theorem [TT] follows after transforming ip' into (p" 
by eliminating the qualitative extended Pnueli operators as in Lemma [TUl 

Consider a generic LTL formula 4> in SNF: 

(f> ^ K A f\ G(x, ^X"(*V,) (24) 

1=1,. ..,M 

where k € L(U), x^ G U = {x^ \ 1 < i < M}, Q = Pun, tt, e P(Q), and D is a 
monotonically non-decreasing mapping [1..M] — !> ]N>o- 

Introduce V letters Y = {yi | 1 < « < V}. Formula >c{y) constrains t/i to 
occur synchronously with every i-th non-stuttering step: 

(/ '^(2/l + (i mod V)) \\ 
y^ A (25) 

\ Vt U2/l + (., modV) / / 

Let Di,D2, ■ ■ ■ ,D„i be the sequence of sets that partition [1..M] and such 
that: i,j £ Dk with k = D{i) = D{j) for some k iff D(i) = D(j) = 4 (and do 
is defined as 0); and i £ Dk^ and j e Dk^ with fci < k2 implies ©(i) < ©(j). 
Then, introduce another m • V letters {zl \ I < i < m,l < j < V}. At every 
i-th non-stuttering step, marked by i/i, the sequence z{, . . . , must hold over 
m of the following V non-stuttering steps; moreover, between each and its 
preceding Zj_i there must be no more than di — di^i non-stuttering steps, unless 
di — di-i > V — i -|- 1. After defining 5i = di — di^i if di — c?i_i < V — i -I- 1 and 
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Si = * otherwise, the qualitative extended Pnueli modalities capture precisely 
this behavior. 



H{z,Pn) 4 /\ G[yi^exqPnl^'^'-''-\zi,...,zl)) (26) 

l<i<V 

Additionally, constrain the zf 's to hold sequentially, according to the follow- 



ing. 

^1 + 0" mod 
+ mod 



l<«<m 



(27) 

Once the 2^'s and the j/j's are constrained, link the Xj's to the values of 
the TTj's in the distance formulas. If some Xi holds, after or at the j-th non- 
stuttcring step and before the j + 1-th, then TTj has to hold at the fc-th position 
in the sequence z{,. . . ,z^, with k = D{i). 



x(x,7r) = /\ G 



l<i<M 
l<j<V 



A I (28) 



Finally, combine the various x formulas to transform ^ into (ji': 



4 ».Y(a)AAc(i<:^'; 



/\x{y)AK{z,Pn)A>c{z, (J)A>c{x,tt) (29) 



Example 12. In the elections example, formulas h{z,\J), and tt) 

are instantiated with V = Vn = 6 and m = rriQ = 4. To instantiate h{z, Pn), 
consider the following table. 

i Yn-i + 1 di di - di-i 6i 



16 111 

2 5 40 39 * 

3 4 41 1 1 

4 3 1460 1419 * 



Lemma 13. (j)' and, (j) are equi- satis fiable over words in var(Q, V/D). 
Proof. The proof consists of two parts. 



SAT{(1)) ^ SAT(0')- Let w e var(Q, V/£>) such that w \= <f). w' adds propo- 
sitions s,yi,zf, constrained as follows, s switches its truth value at every non- 
stuttering step, except for possibly an infinite tail of constant values over w. 
Exactly one of the yj's holds at every instant, and they rotate at every non- 
stuttering step signaled by s. Whenever a given yj holds, a sequence of z^'s 
hold over the following V non-stuttering step, in a sequential fashion. Namely, 
let k be the first step where a certain yj holds, let hi be the last non-stuttering 
before position k + di, and let li be the 5j-th non-stuttering step after 
(included, with ho = k); then, zj starts to hold at min(/ii, ^i, V — fc -|- 1) -|- 1, and 
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holds until the next zj_^_-. Once w' is built, the rest of the proof follows the lines 
of LemmalSl It is clear that w' ^ ApeQ ^('P) /^G(A(p) A A(-ip)) and w' \= k. In 
addition, w' |= K{y) A k{z, U) is a consequence of the set up of the j/j's and the 
z^'s. Then, let i be the current generic instant and h C [1..M] be a generic sub- 
set such that f\ifzbXi A Ai^f; holds at i. Hence, w,i\= X^^^'tTj holds for all 
j G 6 and w,i ^ yJ^^^^^-Kk holds for all k ^ b. The variability of w — and that 
of w' — is bounded by V/D: hence, there are at most V non-stuttering steps of 
item s over positions i to i + D. Let i < ti < ■ ■ ■ < Iy < i + D he these transition 
instants. There are only stuttering steps between any such two consecutive i^'s, 
hence there exists a subset wi < • • • < Um of the t^'s such that zj holds at Ui 
for all i's and some unique j. Now, for all g such that D{g) = i, iig holds at 
k + di and (at least) since the previous and until the next non-stuttering step. 
Because of how each zf^s mark the stuttering positions before k + di, for every 
g such that D{g) — i, iTi must in particular hold where zj first holds; because i 
is generic, w' \= x{x, tt) holds. Also, if di — di^i < V — i -I- 1, there are no more 
than di — di-i non-stuttering steps between Ui-i and u^, for all 1 < i < to (and 

assuming uq = do = 0); this establishes w',i \= exqPn^^''^''"''^'"^ ^z^, . . . , 
In all, w' ^ (p' holds. 

SAT(<?!)') =^ SAT((/i). Let w' be a word in 

var(Q li {s} U {y^ \ I < i <Y} U {zj \ 1 < i < m,l < j < V}, },¥/!)) 

such that w' |= </)'. Let w be w' with all stuttering steps removed; w \= (f>' as well 
from Lemma [TUl Then, let i be the current generic instant and b C [1..M] be a 
generic subset such that Aieb ^i^Ai^b holds at i on w. The rest of the proof 
works inductively on 1 < h < M; let us focus on the more interesting inductive 
step. Let i < ti < ■ ■ ■ < ty he the following V non-stuttering steps of s — and 
hence of any proposition in Q as well, according to y{Q)^ApeQ 
>c{y) implies that a unique yj holds at i; correspondingly, >i{z, Pn) entails that 
there exists a subset of the ui < • • • < Um of the sequence ti < ■ ■ ■ < ty such 
that z^, holds at Wfc + 1 for all 1 < fc < to. Assume Xh holds at i (the case 
of -ix/i is clearly symmetrical and is omitted), with g = D{h); then, >c{x,tt) 
requires that iTh holds with at Ug -|- 1. The inductive hypothesis implies that 
+ 1 < i + dg-i < Ug, and >c{z, Pn) and the definition of Sg guarantee that 
Ug < i + dg. Correspondingly, add 9 = i + dg — Ug — 1 stuttering steps at 
position Ug in w. This "shifts" the previous position Ug + 1 to the new position 
i + dg] hence w,i + dg ^ tt/j and i + dg < dg+i because we added only stuttering 
steps. Overall, induction guarantees that the finally modified w is such that 
w\=(l). □ 

Lemma 14. |(/)'| is polynomial in |Q|, V, |0|u, \<P\g, |0|p- 

Proof. The size of 0' is \k\ + \Q\^ + \>c{y)\ + \>c{z,Pn)\ + \>c{z,U)\ + \>c{x,tt)\, up 
to constant factors. Then, \k\ is |0|u; \x{y)\ is 0{Y^); |>f(z,Pn)| is 0{m'^ • V^), 
which is O(|0|| ■ V^), then the qualitative extended Pnueli operators can be 
eliminated as shown in Section FG.li getting an LTL formula of size still polynomial 
in |0|g • V - |0|p; |>f(z,U)| is 0(m3 • V^) which is 0(|(/.|| • V^); and \x{x,tt)\ is 
0(M • V • (Af + V + \4>\p)), which is 0(1011 • V2 • |(/)|p). □ 
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Example 15. Consider the running elections example and transform into 
fi' according to the above construction. The following is a partial model for 
O', where all propositions not appearing at some position are assumed to be 
false there, non-stuttering steps are in bold and underlined, while a hat marks 
successors of non-stuttering steps. 
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It should be clear that the model can be transformed into one satisfying il, 
for example the one in Example |4l For instance, the metric requirement of e 
occurring once at 1460 -I- 1 — 40 = 1421 can be accommodate by removing all 
the stuttering steps at position 8 and by adding 1421 — 8 = 1413 additional 
stuttering steps at position 2. 

7 Future work 

Future work will encompass implementation and generalizations. In particu- 
lar, we plan to generalize the results to the case of subword stuttering, i.e., 
where a subword such as ahc is repeated n times such as in (abc)'^ (cf. |KS05| ). 
Also, adaptation of the technique to MTL will be considered. Finally, we will 
implement the reduction technique and assess its practicality experimentally. 
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